Last update: March 17, 2019. This website uses cookies. By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. More information

 Actions

Whonix for VirtualBox with CLI

< VirtualBox Testers Only Version


1. Download Whonix Whonix old logo.png CLI for Windows Windows logo - 2012.svg.png, Mac Rsz osx.png and Linux Tux.png FREE


Version: 14.0.1.4.4

Whonix
 		Anonymous Download
Possible [1] 		Download Security
without Verification 		Download Security
with Verification
Ambox warning pn.svg.png By downloading, you acknowledge that you have read, understood and agreed to our Terms of Service and License Agreement. Ambox warning pn.svg.png
Https long.png
 Download Yes [1] Medium High [2]
Button sig.png OpenPGP Signature

( sha512 , sig )

Yes [1] - -
Crypto key.png Verify VirtualBox images using this Signing Key Yes [1] -
Crypto key.png Verify KVM images using this Signing Key Yes [1] -


Verify the Whonix Images

It is important to check the integrity of the downloaded virtual machine images to ensure that neither a man-in-the-middle attack or file corruption occurred (see Download Security).

Whonix virtual machine images are cryptographically signed by Whonix developer Patrick Schleizer using OpenPGP. [3]

If you know how to use an OpenPGP key, download the Whonix Signing Key and the Whonix signatures straight away.

Otherwise, use the following instructions:

Download Whonix CLI

2. Install VirtualBox Virtualbox logo.png

  • Linux Tux.png: please press expand on the right side.

Hosts using a non-Debian OS:

Install VirtualBox as per the normal mechanism for your Linux distribution.

Debian hosts:

Note: this applies to Whonix 14.0.1.4.4. Later Whonix versions may use a codename different to stretch.

Package virtualbox should be installed from Debian backports. [4] [5] [6]

1. On the host.

Open a terminal.

2. Add the current Debian stable backports codename stretch-backports to Debian apt sources.

[7] 

sudo su -c "echo -e 'deb http://http.debian.net/debian stretch-backports main contrib' > /etc/apt/sources.list.d/backports.list"
3. Update the package lists. 

sudo apt-get update

4. Install the selected software. 

sudo apt-get install virtualbox/stretch-backports linux-headers-$(uname -r)

The procedure is now complete.

5. Undo.

On occasion it is necessary to undo this configuration, for example when upgrading from Debian stretch to buster. [8] To proceed, run. 

sudo rm /etc/apt/sources.list.d/backports.list

3. Import Whonix Whonix old logo.png into VirtualBox Virtualbox logo.png

For Whonix VirtualBox import instructions, please press on expand on the right.

Start VirtualBox
Open The virtualbox1.png

Click on Filethen choose Import Appliance...
Select Import Applience2.png

Navigate and select Whonix image and press next
Select whonix image and press next3.png

Do NOT change anything! Just click on Import
Press import4.png

Then press Agree
Press agree5.png

Wait until Whonix-Gateway.ova has been imported
Wait for importing6.png

Repeat the import step also for Whonix-Workstation.ova
Do the same for whonix workstation7.png

Now start both Whonix-Gateway and Whonix-Workstation
Start both of them8.png

Miscellaneous

There are also Video Tutorials.

If you still need help, please check the Support page.

4. Start Whonix

Starting Whonix is simple.

Start VirtualBox -> Double-click the Whonix-Gateway and Whonix-Workstation.

5. VirtualBox Screen Resolution Bug

Cli4.png

If the display presents like the image on the right-hand side, then you are affected by a screen resolution bug which only occurs in the XFCE version of Whonix in VirtualBox. To correct the resolution, apply the following workaround.

1. Maximize the window.

2. VirtualBox VM Windows -> View -> Virtual Screen 1 -> choose any, resize to some other resolution

3. VirtualBox VM Windows -> View -> Auto-resize Guest Display

Cli3.png

First time user?

Footnotes and Experimental Spectre / Meltdown Defenses

Please press on expand on the right.

VirtualBox Stable Version | VirtualBox Testers Only Version

Testers only! For more information please press on expand on the right.

These experimental Spectre/Meltdown defenses are related to issues outlined in Firmware Security and Updates. Due to the huge performance penalty and unclear security benefits of applying these changes, it may not be worth the effort. The reason is VirtualBox is still likely vulnerable, even after:

  1. A host microcode upgrade.
  2. A host kernel upgrade.
  3. A VM kernel upgrade.
  4. A "not vulnerable" result from spectre-meltdown-checker run on the host.
  5. Installation of the latest VirtualBox version. [9]
  6. All Spectre/Meltdown-related VirtualBox settings are tuned for better security as documented below.

To learn more, see: VirtualBox 5.2.18 vulnerable to spectre/meltdown despite microcode being installed and the associated VirtualBox forum discussion. [10] Users must patiently wait for VirtualBox developers to fix this bug.

On the host. [11] [12] [13] [14] [15] [16] [17] 

VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-entry on
VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-entry on
VBoxManage modifyvm "Whonix-Gateway" --ibpb-on-vm-exit on
VBoxManage modifyvm "Whonix-Workstation" --ibpb-on-vm-exit on
VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-vm-entry on
VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-vm-entry on
VBoxManage modifyvm "Whonix-Gateway" --l1d-flush-on-sched on
VBoxManage modifyvm "Whonix-Workstation" --l1d-flush-on-sched on
VBoxManage modifyvm "Whonix-Gateway" --spec-ctrl on
VBoxManage modifyvm "Whonix-Workstation" --spec-ctrl on
VBoxManage modifyvm "Whonix-Gateway" --nestedpaging off
VBoxManage modifyvm "Whonix-Workstation" --nestedpaging off


The above instructions only apply to the default VM names Whonix-Gateway and Whonix-Workstation. Therefore, if Multiple Whonix-Workstations and/or Multiple Whonix-Gateways are configured, then repeat these instructions using the relevant name/s.


Footnotes[edit]

  1. ↑ 1.0 1.1 1.2 1.3 1.4 By using the Tor Browser Bundle (TBB). For an introduction, see Tor Browser. See also Hide Tor and Whonix from your ISP.
  2. ↑ It does not matter if the bulk download is done over an insecure channel if OpenPGP verification is used at the end.
  3. ↑ OpenPGP is a standard for data encryption that provides cryptographic privacy and authentication through the use of keys owned by its users.
  4. ↑ This is required since VirtualBox in unavailable in Debian stretch.
  5. ↑ This is non-ideal, see next footnote.
  6. ↑ Users should Prefer Packages from Debian Stable Repository, but using backports is better than manual software installation or using third party package managers since this prefers APT. To contain the risk, Non-Qubes-Whonix users might want to consider using Multiple Whonix-Workstations and Qubes-Whonix users might want to consider using Multiple Qubes-Whonix TemplateVMs or Software Installation in a TemplateBasedVM.
  7. ↑ Or alternatively use the .onion mirror. 
    sudo su -c "echo -e 'deb tor+http://vwakviie2ienjx6t.onion/debian stretch-backports main contrib' > /etc/apt/sources.list.d/backports.list"
  8. ↑ Most often this step applies before attempting major Whonix upgrades; upgrade instructions are also made available at that time (see stay tuned).
  9. ↑ VirtualBox version 5.2.18 or above is required since only that version comes with Spectre/Meltdown defenses. See https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739/22.
  10. ↑ Also see the following Whonix forum discussion: Whonix vulerable due to missing processor microcode packages? spectre / meltdown / retpoline / L1 Terminal Fault (L1TF)
  11. ↑

    --ibpb-on-vm-[enter|exit] on|off: Enables flushing of the indirect branch prediction buffers on every VM enter or exit respectively. This could be enabled by users overly worried about possible spectre attacks by the VM. Please note that these options may have sever impact on performance.
    https://www.virtualbox.org/manual/ch08.html

    There is a mistake in the VirtualBox manual stating enter which does not work. It is actually entry.

  12. ↑ https://www.virtualbox.org/manual/ch08.html

    --l1d-flush-on-vm-enter on|off: Enables flushing of the level 1 data cache on VM enter. See Section 13.4.1, “CVE-2018-3646”.

  13. ↑

    --l1d-flush-on-sched on|off: Enables flushing of the level 1 data cache on scheduling EMT for guest execution. See Section 13.4.1, “CVE-2018-3646”.
    https://www.virtualbox.org/manual/ch08.html

  14. ↑ https://www.virtualbox.org/manual/ch13.html#sec-rec-cve-2018-3646

    For users not concerned by this security issue, the default mitigation can be disabled using

    VBoxManage modifyvm name --l1d-flush-on-sched off

    Since we want to enable the security feature we set --l1d-flush-on-sched on.

  15. ↑

    --spec-ctrl on|off: This setting enables/disables exposing speculation control interfaces to the guest, provided they are available on the host. Depending on the host CPU and workload, enabling speculation control may significantly reduce performance.
    https://www.virtualbox.org/manual/ch08.html

  16. ↑ According to this VirtualBox ticket --spec-ctrl should be set to on.
  17. ↑

    --nestedpaging on|off: If hardware virtualization is enabled, this additional setting enables or disables the use of the nested paging feature in the processor of your host system; see Section 10.7, “Nested paging and VPIDs” and Section 13.4.1, “CVE-2018-3646”.

No user support in comments. See Support.

Comments will be deleted after some time. Specifically after comments have been addressed in form of wiki enhancements. See Wiki Comments Policy.


Add your comment
Whonix welcomes all comments. If you do not want to be anonymous, register or log in. It is free.

Random News:

Love Whonix and want to help spread the word? You can start by telling your friends or posting news about Whonix on your website, blog or social media.

https | (forcing) onion

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix is a trademark. Whonix is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix itself. (Why?)

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix is provided by ENCRYPTED SUPPORT LP. See Imprint.

Retrieved from "http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/w/index.php?title=VirtualBox_Testers_Only_Version/CLI&oldid=41731"